The data controller is the entity that decides why and how personal data will be processed. It bears the primary responsibility for GDPR compliance.
Who is the data controller?
The data controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Obligations of the controller
- Ensure a legal basis for processing
- Inform data subjects about processing
- Ensure the security of data
- Maintain records of processing activities
- Report security incidents
- Respond to data subject requests
The controller and cookies
The website operator is typically the controller of data collected through cookies. They are responsible for:
- Obtaining valid consent
- Informing users about the cookies in use
- Ensuring the cookie banner functions correctly
- Keeping records of consents